After a long wait, we have released the 2.2.1 version of FreeRADIUS. The focus of this release is stability. Minor features may be added, but the goal is to increase system stability at the cost of missing features.
People interested in major new features should look at the v3 release branch. Our focus now is fixing the last few issues in v3, before making a new release. Once v3 has been released, there will be no further new development on Version 2. Bug fixes and security issues will be addressed for three (3) years after v3 has been released. The change log for v2.2.1 is as follows: Alan DeKok FreeRADIUS Project Leader ----- Feature improvements * Updated dictionaries for alcatel, broadsoft, bskyb, dlink, meru, telkom, trapeze, proxim, zeus, rfc6677, 6911, and rfc6930. * Added %{randstr:..} support. Creates random strings in a controllable format. * Added operator support to rlm_python * Added %{hex:...} for hex version of raw attribute data * Added %{sha1:...} for SHA1 hashing of data * Added %{base64:...} for raw attribute data (e.g. 32-bit IP addr), and %{tobase64:...} for the printable string form (e.g. 1.2.3.4), and %{base64tohex:...} to convert a base64 string to a hex string. * rlm_expr is now responsible for registering many of the xlat expansions. This is cleaner than bundling them all in the server core. You should ensure 'expr' is listed in instantiate to ensure correct operation of xlat expansions. * Use correct terminology when printing errors regarding request/ response/message authenticators. * Added keytab support to Heimdal Kerberos. Patch from Ryan Steinmetz. * radsqlrelay does multiple INSERTs in one transaction. Patch from Uwe Meyer-Gruhl. * Run Post-Proxy-Type Reject {} if the upstream server rejected the request. * On startup, the server checks if it was linked with the correct OpenSSL libraries. If not, it errors out. This prevents later crashes in OpenSSL, due to library incompatibilities. * Added radmin command "hup main.log", to re-open the log files, without HUPing any other part of the server. * Added support for EAP-Key-Name. See raddb/sites-available/default, and look for comments mentioning EAP-Key-Name. MacSec now works. * Added support for hex numbers (0x...) to %{expr: ...} * Backported TLS client certificate validation from 3.0.0. * Run Post-Auth for EAP inner-tunnel methods. * Added more RFCs * Added "show config <path>" to radmin. You can now examine any configuration item in a running server. * Added TLS-Client-Cert-X509v3-Extended-Key-Usage for TLS-based EAP methods. It is set automatically from the fields in the certificate. * Add CRLCP attribute in certificate creation script. Windows phones require it. Patch from Alan Buxey. Bug fixes * Skip OCSP if there's no host / port / url, with soft_fail * Properly decode AT_IDENTITY in EAP-SIM. Patch from Iliya Peregoudov * Thread max_queue_size has better bounds checking. * Use correct variable for warning message if the user misconfigures the server. * radtest is more generous about parsing ppphint * radeapclient now accepts -4 and -6, just like radclient. Patch from John Dennis. * Ignore ".rpmnew" and a bunch of other files when loading config files from a directory. * Wait for child threads before exiting. This prevents errors on exit, but may increase exit time if databases are blocked! Patch from Iliya Peregoudov. * Wrap rbtree calls in mutexes in rlm_cache to prevent memory corruption. Patch from Phil Mayers. * Port fix for %{3GPP-*} expansion from master branch. * Fix sample certificate scripts when multiple client certs are made * Track return code priorities across if/else/elsif in unlang. Closes #107 * In debug mode, print out DHCP options when sending a DHCP packet. * Fixes to the redis modules from Brian Candler * Print better debug message for LDAP "operations error" * Fix a number of minor issues as found by Coverity * Frees module config in order to prevent occasional crash on exit * Update DHCP debugging messages to make it clearer what's going on. * Print multiple DHCP options the correct number of times in debugging mode * On debug builds, don't dlclose() modules when '-m' is used. This allows valgrind to show module symbols. * Don't count Status-Server packets in Access-Request statistics * Minor cleanups to debug output * Be more careful handling module configurations to avoid crash on otherwise clean exit. * For raddebug, correctly set the group of the output file. * renamed dhclient to dhcpclient. People who install it shouldn't have their systems broken. * for EAP-TLS methods, random_file is no longer required. OpenSSL already reads /dev/urandom. * Fix Suse and Redhat scripts. Patches from Fajar Nugraha. * Minor bug fix for base64 decoding. * Allow two consecutive WiMAX TLVs of the same number. * Remove requirement that User-Name has to match MS-CHAP-User-Name. I18n issues means that the character sets could be different. * Don't use ephemeral thread states from PyGILState_Ensure(), use our own, generated one per thread and stored in TLS. * Port module processing fixes from v3. The code is simpler, and one or two esoteric bugs are now gone. * update code handling max_requests_per_server. It should now work correctly. * wrap ASCTIME_R for systems not supporting the standard API. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html